Wing FTP Server RCE Exploit Chain — Lua Code Injection via NULL Byte (CVE-2025-47812 CVSS 10.0 + CVE-2025-47813) — Threadlinqs Intelligence
As of 2026-05-30, Wing FTP Server RCE Exploit Chain — Lua Code Injection via NULL Byte (CVE-2025-47812 CVSS 10.0 + CVE-2025-47813) is a critical-severity vulnerability threat attributed to a N/A-nexus actor, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 16 indicators of compromise.
Threat ID: TL-2026-0241 · Severity: CRITICAL · CVSS: 10 · Status: MONITORING · Category: VULNERABILITY
Attribution: N/A · UNKNOWN
Critical exploit chain in Wing FTP Server before 7.4.4 achieves unauthenticated remote code execution as SYSTEM/root. CVE-2025-47813 (CVSS 4.3) discloses the full server installation path via crafted
Wing FTP Server versions prior to 7.4.4 contain a critical exploit chain combining two vulnerabilities that together achieve unauthenticated remote code execution with SYSTEM (Windows) or root (Linux/macOS) privileges.
## CVE-2025-47812 — Lua Code Injection via NULL Byte (CVSS 10.0)
The core RCE vulnerability stems from improper handling of NULL bytes (\0) in both the user and admin web interfaces. The exploit chain operates through four interconnected weaknesses:
1. **NULL Byte Truncation in Authentication**: The c_CheckUser() function uses strlen() on the provided username. When a NULL byte (%00) is injected into the username, strlen() truncates the string at that point, causing authentication to succeed for the portion before the NULL byte. This allows exploitation via anonymous FTP accounts or any known credentials.
2. **Unsanitized Session Creation**: Despite authentication validating only the truncated portion, the rawset(_SESSION, 'username', username) call in loginok.html preserves the entire unsanitized username from request parameters, including the NULL byte and all subsequent characters.
3. **Lua Script Session Storage**: Wing FTP Server stores session data as executable Lua scripts on disk. The injected payload — crafted as valid Lua code after the NULL byte — is written directly into the session file.
4. **Session File Execution**: When an authenticated endpoint (specifically /dir.html) is accessed with the session UID cookie, the SessionModule.load() function executes session files via loadfile(filepath) followed by f(), triggering the injected Lua payload with full service-level privileges.
A typical exploit payload follows this structure: `anonymous%00]]%0dlocal+h+%3d+io.popen("command")%0dlocal+r+%3d+h%3aread("*a")%0dh%3aclose()%0dprint(r)%0d--` where `]]` closes the existing Lua table syntax, `io.popen()` executes arbitrary system commands, and `--` comments out remaining session data.
The attack requires only two HTTP requests: (1) a POST to /loginok.html with the crafted payload in the username parameter, and (2) a GET to /dir.html with the returned UID cookie to trigger execution.
## CVE-2025-47813 — Installation Path Disclosure (CVSS 4.3)
The loginok.html endpoint in Wing FTP Server before 7.4.4 discloses the full local installation path when an excessively long string is submitted in the UID cookie. This information disclosure (CWE-209) reveals sensitive server configuration details that aid exploitation of CVE-2025-47812 by exposing the exact filesystem location of session files.
## Active Exploitation
Huntress observed the first in-the-wild exploitation on July 1, 2025 — one day after Julien Ahrens (RCE Security) published the detailed vulnerability write-up and PoC on June 30, 2025. The patch (v7.4.4) had been available since May 14, 2025, but many installations remained unpatched.
Multiple distinct threat actors were observed exploiting the same victim from different IP addresses. Post-exploitation activity included network reconnaissance, creation of new local user accounts for persistence, attempted download and execution of malicious batch files, and deployment of ScreenConnect (ConnectWise Control) remote monitoring and management software. Microsoft Defender blocked several malicious activities on the compromised host.
Censys identified approximately 8,103 exposed Wing FTP Server instances as of July 9, 2025, with roughly 5,004 having exposed web interfaces potentially vulnerable to exploitation. Only 105 devices publicly reported version numbers.
## Related Vulnerabilities
CVE-2025-47811 is an additional privilege escalation vulnerability in Wing FTP Server that remains UNFIXED even in v7.4.4. CVE-2025-27889, an information disclosure flaw revealing cleartext passwords, was fixed in v7.4.3 (released March 26, 2025).
## Impact
Successful exploitation grants full SYSTEM/root-level command execution on the underlying server, enabling complete compromise of the host including dat
Weaknesses (CWE)
CWE-158, CWE-94, CWE-209
Target sectors: government, financial, healthcare, technology, manufacturing, education, critical-infrastructure, small-business
Target regions: North America, Europe, Asia-Pacific, Global
Detections & IOCs
As of 2026-07-20, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 16 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
VULNERABILITY, CRITICAL, threat intelligence, cybersecurity, CVE-2025-47812, CVE-2025-47813, T1190, T1078, T1059, T1203, T1059, T1136, T1505, T1068, T1027, T1070